T08 · Insecure Dependencies
Error
- Location
SKILL.md:863- Finding
Unsafe Execution of Repository-Controlled Build Tools and Third-Party Plugins
- Content
View full analysis
&1 | head -30 which mvn && mvn spotless:check 2>&1 | head -30 which mvn && mvn pmd:check -q 2>&1 | head -30 which mvn && mvn spotbugs:check -q 2>&1 | head -30 # === Gradle projects === ./gradlew spotlessCheck 2>&1 | head -30 ./gradlew pmdMain 2>&1 | head -30 ./gradlew spotbugsMain 2>&1 | head -30 # === Standalone tools === which google-java-format && find . -name "*.java" \ -not -path "*/target/*" -not -path "*/build/*" | \ xargs google-java-format --set-exit-if-changed -n 2>&1 | head -30 # === Alibaba P3C rule scan (if integrated) === which mvn && mvn p3c:p3c-check -q 2>&1 | head -30 ``` The optional automatic remediation section also instructs the agent to execute build tools and modify source files: ```bash # Maven: Spotless auto-format (google-java-format) mvn spotless:apply # Gradle: Spotless auto-format ./gradlew spotlessApply # Standalone: google-java-format direct fix find . -name "*.java" -not -path "*/target/*" -not -path "*/build/*" | \ xargs google-java-format --replace ``` ### Technical Analysis The review workflow executes build commands within the repository being reviewed without first establishing that the repository and its build configuration are trusted. In particular, `./gradlew` is a repository-provided executable. A malicious project can replace this wrapper with an arbitrary script, causing direct command execution when any Gradle check is invoked. Gradle build files and initialization logic may also execute code during configuration, before the requested formatting task runs. Maven goals present a related supply-chain risk. Maven can resolve and execute plugins declared by the project or requested on the comma ...[truncated 2360 chars]- Remediation
View remediation